Abnormal call detection intelligent scheduling device and method based on man-machine mixing

Abstract

The invention relates to an abnormal call detection intelligent scheduling device and method based on man-machine mixing. The device is characterized in that the device is deployed in a security management and control network co-constructed by a management bureau and an operator and serves as a set of independent system to be coupled with an IMS network of the operator, and after calling information is collected, an intelligent scheduling module executes research and judgment scheduling. And complete detection and disposal are carried out on the access call and the abnormal call. According to the method, real-time, accurate and efficient identification and disposal of abnormal calls are realized through a mixed mode of'machine automatic screening + manual accurate research and judgment ', and closed-loop dynamic management of risk numbers is formed, so that the anti-fraud and anti-harassment effects are remarkably improved, and misjudgment is reduced. Business applicable to the abnormal call detection method comprises call control business, call authentication business and the like, the abnormal call detection method with intelligent scheduling and man-machine mixing can be realized, the detection accuracy and response speed of the abnormal call are improved, and the operation cost is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to an abnormal call detection intelligent scheduling device and method based on human-computer hybrid. BACKGROUND

[0002] At present, the world is accelerating into the digital and intelligent era, and the safe, stable and efficient operation of communication networks as key information infrastructure is crucial. Voice communication services such as call centers, customer service systems and emergency hotlines are the core channels for enterprise and user interaction, and bear important functions such as customer service, business handling, marketing promotion and emergency rescue.

[0003] However, behind this prosperity also hides great risks and challenges: with the rapid development of mobile communication technology, telecommunications network fraud and nuisance calls have become a serious social nuisance. Criminals use network phones, number changing software and other technical means to frequently carry out fraud and harassment activities, posing a great threat to the property safety and personal privacy of the people.

[0004] In order to solve the detection and processing of abnormal calls, the current main methods are risk control model analysis based on big data analysis and sampling review based on artificial agents. The risk control model based on big data analysis establishes a model by analyzing the call behavior to identify abnormalities. This method has a high degree of automation, but there is a certain misjudgment, especially for new card users or normal users with sudden changes in behavior patterns. Purely automated models often set a high sensitivity in pursuit of high interception rate, resulting in misinterception of normal calls and affecting user experience. And reducing the sensitivity will increase the risk of missed interception. Sampling review based on artificial agents has efficiency bottlenecks and sampling hit problems. Human experts have irreplaceable experience, intuition and complex reasoning ability, but they cannot cope with thousands of calls per second, and the cost of manpower is high and prone to fatigue.

[0005] In the face of increasing telecommunications network fraud and nuisance calls, it has become an important issue to solve the drawbacks of risk control model analysis based on big data analysis and sampling review based on artificial agents, and to achieve high-coverage detection and accurate detection. SUMMARY

[0006] In view of the problems in the prior art, the purpose of the present application is to provide a technical scheme of an abnormal call detection intelligent scheduling device and method based on human-computer hybrid.

[0007] The abnormal call detection intelligent scheduling device based on human-computer hybrid is deployed in a security management and control network jointly built by the management bureau and the operator, coupled with the operator's IMS network, and is used for abnormal call detection and disposal. The device comprises: a signaling collection module, configured to collect SIP signaling data in a call process in depth; a media collection module, configured to collect RTP media stream data of the call; a signaling analysis module, configured to analyze, normalize and correlationally analyze the signaling data collected by the signaling collection module, extract call key information and identify abnormal behaviors at a signaling level; an intelligent scheduling module, configured to perform real-time risk scoring and preliminary screening on the call based on the output of the signaling analysis module, and make a disposal decision or generate an audit task work order according to the risk score; an artificial audit module, configured to provide a man-machine interactive interface, so that an auditor can audit suspicious calls pushed by the intelligent scheduling module and make a disposal decision.

[0008] The abnormal call detection intelligent scheduling device based on man-machine hybrid has the characteristics that: The signaling collection module directly accesses a SIP signaling link of an IMS network of an operator to collect signaling data, and the collected signaling data includes call initiation, response and end messages; The media collection module performs recording and real-time transcription on calls determined to be risky, so as to provide content basis for artificial audit; The call key information extracted by the signaling analysis module includes at least one of a calling number, a called number, a call time, a call duration and a call result, and the abnormal behaviors identified include frequent call and short duration call groups; The intelligent scheduling module has a built-in strategy engine and a rule base, and is configured to perform real-time risk scoring on the call; for high-risk or normal calls, a disposal decision is directly made; for suspicious calls, a structured audit task work order is generated and dynamically assigned to the artificial audit module; The artificial audit module provides a graphical interface, an auditor can view call details, risk scoring reasons, call history, call recording, and make a judgment of confirming fraud, confirming normal or needing to continue observation, and the result is fed back to the intelligent scheduling module.

[0009] The abnormal call detection intelligent scheduling method based on man-machine hybrid has the characteristics that it includes the following steps: 1) Collecting signaling and media stream data of a call in real time through a signaling collection module and a media collection module; 2) Analyzing and extracting call key information and identifying abnormal behaviors through a signaling analysis module; 3) Performing real-time risk scoring and preliminary screening on the call based on the output of the signaling analysis module through an intelligent scheduling module; 4) For calls with a risk score at a high-risk or normal threshold, the intelligent scheduling module directly makes a disposal decision; 5) For the calls with suspicious threshold risk score, the intelligent dispatching module generates an audit task order and dispatches to the manual audit module; 6) The suspicious calls are audited by the manual audit module, and disposal decisions are made based on media stream data and call details.

[0010] The intelligent dispatching method based on human-machine hybrid abnormal call detection is characterized in that the intelligent dispatching module divides the calls into three categories according to the risk score: high-risk calls, normal calls and suspicious calls; for high-risk calls and normal calls, disposal is directly made through the BOSS system; for suspicious calls, manual audit is submitted.

[0011] The intelligent dispatching method based on human-machine hybrid abnormal call detection is characterized in that the audit results of the manual audit module are fed back to the intelligent dispatching module in real time, and are used to update the training of the signaling analysis model, so as to optimize the rule library and risk score logic.

[0012] The intelligent dispatching method based on human-machine hybrid abnormal call detection is characterized in that the signaling analysis module identifies at least one of the following abnormal behaviors in the signaling layer: frequent calls, short duration call groups, first call of new number and behavior pattern mutation.

[0013] The intelligent dispatching method based on human-machine hybrid abnormal call detection is characterized in that it specifically includes a machine full-automatic disposal process and a manual in-depth research and decision-making process, wherein the intelligent dispatching module dynamically drives the switching of the processes.

[0014] The intelligent dispatching method based on human-machine hybrid abnormal call detection is characterized in that the machine full-automatic disposal process includes: The signaling collection module collects call signaling and pushes it to the signaling analysis module; The signaling analysis module analyzes the signaling and pushes the call analysis results to the intelligent dispatching module; The intelligent dispatching module pushes disposal operations to the BOSS system for calls within the abnormal call threshold range; The intelligent dispatching module directly feeds back the audit results for calls within the normal call threshold.

[0015] The intelligent dispatching method based on human-machine hybrid abnormal call detection is characterized in that the manual in-depth research and decision-making process includes: For suspicious calls, the intelligent dispatching module generates an audit order and assigns it to the manual audit module; The manual audit module calls media data for auditors to audit; The auditors make disposal decisions based on the call content, and feed back the results to the signaling analysis module through the intelligent dispatching module.

[0016] The aforementioned intelligent scheduling method for abnormal call detection based on human-machine hybrid operation is characterized in that the intelligent scheduling module encapsulates caller and called party information, risk score, trigger rule details and number historical behavior profile when generating audit task work orders, and dynamically allocates work orders according to the urgency of the work order, fraud type and auditer status.

[0017] This invention introduces an intelligent scheduling module to construct a novel defense system centered on intelligent scheduling and featuring human-machine collaboration. Through a hybrid model of "automatic machine screening + precise human analysis," it achieves real-time, accurate, and efficient identification and handling of abnormal calls, forming a closed-loop dynamic management system for risky numbers. This significantly improves the detection accuracy and response speed of abnormal calls, while reducing operating costs. Furthermore, it continuously evolves through a learning and feedback mechanism, ultimately providing core technical support for building a clean, reliable, and secure communication environment.

[0018] The applicable services of this invention include call management services, call authentication services, etc.; this invention realizes an intelligent scheduling and human-machine hybrid abnormal call detection method, which improves the detection accuracy and response speed of abnormal calls and reduces operating costs.

[0019] This invention can be applied to VoLTE voice or video call scenarios, and realizes the collection and analysis of call data through SIP protocol signaling and RTP media stream. Attached Figure Description

[0020] Figure 1 This is a block diagram of the modules of the present invention; Figure 2 This is a flowchart illustrating the fully automated processing of the machine according to the present invention; Figure 3 This is a flowchart of the manual in-depth analysis and decision-making process of this invention. Detailed Implementation

[0021] The present invention will be further described below with reference to the accompanying drawings: An intelligent dispatching device for abnormal call detection based on human-machine hybrid operation is deployed in a security management network jointly built by the regulatory authority and the operator. As an independent system coupled with the operator's IMS network, when a user call passes through the operator's network, the device collects signaling and media data from the call information. Through intelligent dispatching and based on a human-machine hybrid collaborative working mode, it detects and handles abnormal calls. The device consists of a signaling acquisition module, a media acquisition module, an intelligent dispatching module, a manual review module, and a signaling analysis module.

[0022] Signaling collection module: responsible for deep collection of SIP signaling data in the call process, including call initiation, response, end and other signaling messages, providing basic data for analyzing call behavior and link establishment, the module directly accesses the SIP signaling link of the IMS network for collection.

[0023] Media collection module: responsible for collecting RTP media stream data of the call. For calls judged to be at risk, the module can record and transcribe in real time to provide content basis for manual review.

[0024] Signaling analysis module: analyzes, normalizes and correlates the original signaling obtained by the signaling collection module, extracts key information such as caller and callee numbers, call time, call duration, call result, and identifies abnormal behavior at the signaling level.

[0025] Intelligent scheduling module: the brain and dispatch center of the entire device, with a built-in policy engine and rule base, receiving input from the signaling analysis module, performing real-time risk scoring and preliminary screening on calls. For clear high-risk or normal calls, a disposal decision can be made directly; for suspicious calls in the gray area, they are packaged as review task work orders and intelligently dispatched and assigned to the manual review module.

[0026] Manual review module: provides a graphical human-machine interface, where the reviewer can view suspicious call details pushed by the intelligent scheduling module, including caller and callee information, call history, risk score reason, and can also retrieve call recording for listening. After the reviewer makes a final judgment of "confirm fraud", "confirm normal", "need to continue observation", the result is fed back to the intelligent scheduling module.

[0027] An abnormal call detection intelligent scheduling method based on human-machine hybrid, when a user call is triggered through the operator's network, the signaling collection module and the media collection module collect the signaling and media stream of the call initiated by the monitored number or directed to the monitored number in real time, complete call triggering and data collection; the intelligent scheduling module analyzes the call in real time based on the output of the signaling analysis module and the preset strategy, makes a preliminary disposal judgment; for high-suspicious calls that are difficult to automatically judge, generate task work orders and dispatch to the manual review module, complete intelligent preliminary screening and scheduling; the reviewer analyzes the details of the suspicious call, including call records and media content, on the manual review interface, and makes a disposal decision.

[0028] The signaling analysis module and the manual review module have the ability of "machine screening-human judgment" mixed cooperation. The signaling analysis module is responsible for completing machine screening, fully utilizing the breadth and efficiency of the machine, and is the first line of defense of full automation, low latency and high concurrency. It is the "sensory nerve" and "preliminary brain" of the device, responsible for processing massive and clearly defined call traffic. The manual review module is responsible for completing human judgment, fully utilizing the depth and wisdom of humans, and is the final decision center for high-value and high-difficulty cases. It is the "wisdom brain" and "decision center" of the system, responsible for processing complex and ambiguous cases that the machine cannot determine.

[0029] The intelligent scheduling module has the ability of intelligent scheduling. The cooperation of the signaling analysis module and the manual review module is not a fixed process, but a closed-loop process driven by the intelligent scheduling module and intelligently. Intelligent scheduling includes machine full-automatic handling, intelligent task pushing and scheduling, and human depth research and decision. Machine full-automatic handling: after the signaling analysis module analyzes the call, if the risk score is close to the high risk level of the blacklist or close to the low risk level of the whitelist or completely normal, the authentication research and judgment are directly completed. Such calls do not require human intervention, and the processing time is in the order of milliseconds, ensuring efficiency and high concurrency. Intelligent task pushing and scheduling: when the signaling analysis module determines that the risk score is at the intermediate threshold or triggers the "new number first call" and "behavior pattern mutation" special rules, the intelligent scheduling module will encapsulate the call instance as a structured audit work order. The work order not only contains basic information such as the main and called parties, but also contains the analysis conclusion of the signaling analysis module, the risk score, the trigger rule details, and the historical behavior portrait of the number. All of this provides sufficient decision-making basis for the auditor. The intelligent scheduling module dynamically assigns the work order to the most suitable human review agent according to the urgency of the work order, the type of fraud, and the busy state of the auditor. Human depth research and decision: the auditor receives the work order on the interface of the manual review module. The interface integrates all relevant information and provides "play recording", "view history", and "one-key block / pass" function buttons. The auditor makes a final decision within tens of seconds to a few minutes by comprehensively analyzing all information, especially by listening to the call content. The decision result of the auditor is returned to the intelligent scheduling module in real time. At the same time, the decision result is recorded in the database as a gold sample. High-quality labeled data is used for: model training and rule optimization, improving the threshold and logic of the system administrator to adjust and optimize the rule base, making the "machine screening" more accurate.

[0030] The following takes the call security governance server in the IMS network as an example to configure the governance server to achieve the following requirements: the governance server performs machine control and identification on high-risk calls, performs manual review on suspected calls, realizes the mixed detection and scheduling of detection services, and completes the intelligent call detection service.

[0031] For example,Figure 2 The process of machine full-automatic handling is as follows: 1) Session initialization request: the core network initiates a new VoLTE voice or video call session, sends an INVITE request message in SIP protocol to the signaling collection module, and the message contains the main called number, SDP session description information, etc. 2) Ringing indication: the core network informs the signaling collection module that the called user terminal has been addressed and starts ringing. The signaling collection module records this state for subsequent signaling analysis to calculate the ringing duration and other key indicators; 3) Session update and successful response: the UPDATE request message and its corresponding 200OK successful response message are negotiated and interacted by the signaling collection module and the core network; the session media stream information parameters are updated during the call establishment process, and the signaling collection module guides the media stream negotiation to the media collection module; 4) RTP media access: the media collection module receives the audio and video media information transmitted by the core network, stores it through encrypted caching, and calls the data for subsequent business audit by the artificial audit module; 5) Session successful response: the final successful response to the initial INVITE request message indicates that the called user has answered the phone, and the call channel is formally established; 6) Session confirmation signal: the confirmation of the 200OK successful response message completes the SIP message three-way handshake, indicating the complete establishment of the call signaling process, and the two parties start talking through the media stream; 7) Signaling event push: the signaling collection module uploads the original signaling key information, including the data of INVITE, 180RING, 200OK and other signaling messages and their accurate timestamps, to the signaling analysis module; 8) Signaling model analysis: the original signaling obtained by the signaling collection module is analyzed, normalized and correlated, and key information such as main and called numbers, call time, call duration, call result, etc. is extracted, and according to the established model, frequent calls, short duration call groups and other abnormal behaviors in the signaling layer are identified; 9) Call analysis result push: the signaling analysis module pushes the call analysis results, including the caller number, called number, call time, call identifier, identification result, identification model basis and other information to the intelligent dispatching module; 10) Call abnormality handling push: when the call is identified as a high abnormal call threshold, the intelligent dispatching platform pushes the abnormal call handling operation to the BOSS system according to the risk handling configuration information to handle the abnormal call; 11) Audit result feedback: when the call is identified within the normal call threshold, the intelligent dispatch platform directly feeds back the audit result to the signaling analysis module; when the call is identified within the abnormal call threshold, the intelligent dispatch platform first pushes to the BOSS system operation for disposal, and then feeds back the audit result to the signaling analysis module; 12) Model training iteration: the signaling analysis module imports the call information identified as normal and abnormal into modeling training, updates the signaling analysis model, and improves the signaling model recognition accuracy.

[0032] As Figure 3 , the artificial deep judgment and decision-making process is as follows: 1.1) Session initialization request: the core network initiates a new VoLTE voice or video call session, sends an INVITE request message in SIP protocol to the signaling collection module, which contains the caller and callee numbers, SDP session description information, etc. 2.1) Ringing indication: the core network notifies the signaling collection module that the called user terminal has been addressed and started ringing; the signaling collection module records this state for subsequent signaling analysis to calculate the ringing duration and other key indicators. 3.1) Session update and successful response: the UPDATE request message and its corresponding 200OK successful response message are negotiated and interacted by the signaling collection module and the core network; the session media stream information parameters are updated during the call establishment process, and the media stream negotiation is guided to the media collection module by the signaling collection module. 4.1) RTP media access: the media collection module receives the audio and video media information transmitted by the core network, stores it through encryption caching for subsequent data calling by the artificial audit module during business audit. 5.1) Session successful response: the final successful response to the initial INVITE request message indicates that the called user has answered the phone, and the call channel is formally established. 6.1) Session confirmation signal: confirmation of the 200OK successful response message, completes the SIP three-way handshake, indicating the complete establishment of the call signaling process, and both parties start talking through the media stream. 7.1) Signaling event push: the signaling collection module uploads the original signaling key information, including the data of INVITE, 180RING, 200OK, etc. signaling messages and their accurate timestamps to the signaling analysis module. 8.1) Signaling model analysis: analyze, normalize and correlate the original signaling obtained by the signaling collection module, extract key information such as caller and callee numbers, call time, call duration, call result, etc., and identify frequent calls, short duration call groups and other abnormal behaviors at the signaling level according to the established model. 9.1) Call analysis result push: the signaling analysis module pushes the call analysis result, including the call calling number, called number, call time, call identification, identification result, identification model basis, etc. to the intelligent scheduling module; 10.1) Artificial audit push: when the call is identified as a suspicious call in the medium-low risk gray zone, it is packaged as an audit task work order, intelligently scheduled and assigned to the artificial audit module; 11.1) Call media data: the auditor receives the work order on the interface of the artificial audit module. The interface integrates all relevant information. When the play recording function button is selected, the artificial audit module triggers the media collection module to call the media data; 12.1) Artificial audit: the auditor comprehensively analyzes all information, especially by listening to the call content, and makes a final decision within tens of seconds to a few minutes; 13.1) Call exception handling push: when the auditor judges that the call is abnormal, selects the one-key interception function button, and pushes the abnormal call handling operation to the BOSS system to handle the abnormal call; 14.1) Audit result feedback: the decision result of the auditor is returned to the intelligent scheduling module in real time; 15.1) Audit result transmission: the intelligent scheduling module returns the final decision result of the call identification to the signaling analysis module in real time; 16.1) Model training iteration: the signaling analysis module imports the call information identified as normal and abnormal into the modeling training, updates the signaling analysis model, and improves the signaling model identification accuracy.

[0033] Notes: IMS (IP Multimedia Subsystem): IP Multimedia System, composed of all multimedia service function entities, including a collection of signaling and bearer related function entities.

[0034] SIP (Session initialization Protocol): Session Initiation Protocol, a text-based application layer control protocol used to create, modify and release a session involving one or more participants.

[0035] BOSS (Business & Operation Support System): a basic platform for information management of business processing of telecommunications enterprises, realizing order management, resource management, customer relationship management and other full-process business support.

[0036] VoLTE (Voice over Long-Term Evolution): Voice over Long-Term Evolution, a high-speed wireless communication standard for mobile phones and data terminals.

[0037] SDP (Session Description Protocol): Session Description Protocol, a text-based protocol used to describe streaming session parameters.

[0038] RTP (Real-Time Transport Protocol): Real-Time Transport Protocol, an Internet transport standard that specifies a way for programs to handle the transport of multimedia data over single- or multi-point network services.

Claims

1. A human-machine hybrid-based abnormal call detection intelligent scheduling device, deployed in a security management network jointly built by a pipe bureau and an operator, coupled with an operator IMS network, used for abnormal detection and disposal of calls, characterized in that, The device comprises: a signaling collection module for collecting SIP signaling data in a call process in depth; a media collection module for collecting RTP media stream data of the call; a signaling analysis module for analyzing, normalizing and correlation analyzing the signaling data collected by the signaling collection module, extracting call key information and identifying abnormal behaviors at the signaling level; an intelligent scheduling module for real-time risk scoring and preliminary screening of the call based on the output of the signaling analysis module, and making disposal decisions or generating review task work orders according to the risk score; an artificial review module for providing a man-machine interactive interface for the reviewer to review the suspicious call pushed by the intelligent scheduling module and make disposal decisions.

2. The hybrid human-computer-based abnormal call detection intelligent scheduling device according to claim 1, characterized in that: the signaling collection module directly accesses the SIP signaling link of the operator's IMS network for collection, and the collected signaling data includes call initiation, response and end messages; the media collection module performs recording and real-time transcription for the calls determined to be risky, providing content basis for artificial review; the signaling analysis module extracts at least one of the call key information including the caller and callee numbers, call time, call duration and call result, and identifies abnormal behaviors including frequent calling and short duration calling groups; the intelligent scheduling module has a built-in strategy engine and rule base for real-time risk scoring of the call; for high-risk or normal calls, disposal decisions are made directly; for suspicious calls, structured review task work orders are generated and dynamically assigned to the artificial review module; the artificial review module provides a graphical interface, and the reviewer can view call details, risk scoring reasons, call history, call recording, and make judgments of confirming fraud, confirming normal or needing further observation, and the results are fed back to the intelligent scheduling module.

3. A human-machine hybrid based abnormal call detection intelligent dispatching method, characterized in that The method comprises the following steps: 1) collecting signaling and media stream data of the call in real time through the signaling collection module and the media collection module; 2) analyzing and extracting call key information and identifying abnormal behaviors through the signaling analysis module; 3) real-time risk scoring and preliminary screening of the call based on the output of the signaling analysis module through the intelligent scheduling module; 4) for calls with risk scores at high-risk or normal threshold, the intelligent scheduling module makes disposal decisions directly; 5) for calls with risk scores at suspicious threshold, the intelligent scheduling module generates review task work orders and schedules them to the artificial review module; 6) reviewing suspicious calls through the artificial review module and making disposal decisions based on media stream data and call details.

4. The human-machine hybrid-based abnormal call detection intelligent dispatching method according to claim 3, characterized in that The intelligent scheduling module classifies calls into three categories according to risk scores: high-risk calls, normal calls and suspicious calls; for high-risk calls and normal calls, disposal is made directly through the BOSS system; for suspicious calls, artificial review is submitted.

5. The human-machine hybrid based abnormal call detection intelligent dispatching method according to claim 3, characterized in that The review results of the artificial review module are fed back to the intelligent scheduling module in real time and used to update the training of the signaling analysis model to optimize the rule base and risk scoring logic.

6. The human-machine hybrid based abnormal call detection intelligent dispatching method according to claim 3, characterized in that The signaling analysis module identifies at least one of the following abnormal behaviors in the signaling level: frequent calls, short duration call groups, first call of new numbers, and behavior pattern mutations.

7. The human-machine hybrid based abnormal call detection intelligent dispatching method according to claim 3, characterized in that: Specifically, the intelligent dispatching module dynamically drives the switching of a machine full-automatic handling process and a manual in-depth judgment and decision-making process.

8. The human-machine hybrid based abnormal call detection intelligent dispatching method according to claim 7, characterized in that The machine full-automatic handling process includes: A signaling collection module collects call signaling and pushes it to a signaling analysis module; The signaling analysis module analyzes the signaling and pushes call analysis results to an intelligent dispatching module; The intelligent dispatching module pushes handling operations to a BOSS system for calls within an abnormal call threshold range; The intelligent dispatching module directly feeds back audit results for calls within a normal call threshold.

9. The human-machine hybrid based abnormal call detection intelligent dispatching method according to claim 7, characterized in that The manual in-depth judgment and decision-making process includes: For suspicious calls, the intelligent dispatching module generates an audit work order and assigns it to a manual audit module; The manual audit module calls media data for auditors to audit; The auditors make handling decisions based on the call content and feed back the results to the signaling analysis module through the intelligent dispatching module.

10. The human-machine hybrid based abnormal call detection intelligent dispatching method according to claim 3, characterized in that When generating an audit task work order, the intelligent dispatching module encapsulates the calling / called information, risk score, trigger rule details, and number historical behavior portrait, and dynamically assigns the work order according to the work order urgency, fraud type, and auditor state.

Images